Three Security Stories You May Have Missed: Airport Attack, Fake Breach Data, and a Bank Under Pressure

Key points

• Manchester Airports Group confirmed a cyberattack that disrupted operations at multiple UK airports.
• Data purportedly stolen from workwear brand Carhartt was found to be partly fabricated.
• US Bank denied the substance of claims made by a ransomware gang, a criminal group that locks victims' files and demands payment to restore them.
• A scare involving Log4j, widely used software for recording computer activity, raised fresh concerns about a years-old but still dangerous security flaw.

What happened at Manchester Airports?

Hackers hit Manchester Airports Group, which operates Manchester, East Midlands and Stansted airports, disrupting internal systems. Passengers may have experienced delays or outages as staff worked around affected systems.

We covered the breach in detail on 27 August, when our story found that email addresses, phone numbers and car registrations had been pulled from MAG's systems, though payment details were untouched. Transport infrastructure is a particularly ugly target: it can't go offline while repairs happen, and the data it holds feeds convincing phishing attempts, scam messages designed to look legitimate.

Was the Carhartt breach real?

Partly, but not entirely. Researchers examining data that criminals claimed to have stolen from Carhartt, the American workwear company, found portions were fabricated or recycled from older leaks.

This tactic is more common than most people realise. Groups sometimes inflate the value of a haul by mixing real records with fake ones, or repackaging data from different companies altogether. It muddies the water for investigators. Our 27 August report showed the ShinyHunters crew demanded $3.3 million from Carhartt before dumping what it claimed was 12.9 million customer records after the company walked away. If you have a Carhartt account, change your password.

Why is US Bank in the news?

A ransomware gang claimed to have breached US Bank and threatened to publish stolen data. The bank disputed the account, as noted in SecurityWeek's roundup.

Banks are frequent targets for this kind of public pressure whether or not a real breach occurred. The criminal logic is simple: an unverified claim can spook customers and push a company toward paying. US Bank hasn't confirmed any data loss. US banking regulators require prompt disclosure when customer information is genuinely at risk, so the absence of a formal notice is meaningful.

The Log4j problem refuses to go away

A fresh scare surfaced around Log4j, open-source software that millions of organisations use to log computer activity. A critical flaw discovered in late 2021 let attackers run their own code on vulnerable systems remotely, what researchers call an RCE (remote code execution) vulnerability.

Patches have existed for years. The persistent problem is that Log4j sits deep inside countless third-party products, and some organisations still haven't applied the fix. If your software vendor has issued a Log4j-related update you haven't installed, that's the most useful thing you can do today.

The plain judgement here: the Carhartt inflation tactic deserves more attention than it's getting. Fabricated breach data shifts investigator effort, muddies regulatory timelines and lets real exfiltration stay hidden longer.